PT-2025-10746 · Unknown · Sipass Integrated Acc-Ap +1

Name of the Vulnerable Software and Affected Versions: SiPass integrated AC5102 ACC-G2 versions prior to V6.4.9 SiPass integrated ACC-AP versions prior to V6.4.9 Description: A vulnerability has been identified where affected devices improperly sanitize input for the "pubkey" endpoint of the REST...

PT-2025-11215 · Froxlor · Froxlor

Name of the Vulnerable Software and Affected Versions: Froxlor versions prior to 2.2.6 Description: Froxlor is open-source server administration software. A vulnerability allows users, such as resellers or customers, to create accounts with the same email address as an existing account, creating...

PT-2025-10700 · Libzvbi +5 · Libzvbi +5

Name of the Vulnerable Software and Affected Versions: libzvbi versions 0.2.43 and earlier Description: A problem has been found in the function vbi strndup iconv ucs2 of the file src/conv.c. The manipulation of the argument src length leads to an uninitialized pointer. It is possible to launch t...

Debian dla-4084 : libmodbus-dev - security update

The remote Debian 11 host has packages installed that are affected by multiple vulnerabilities as referenced in the dla-4084 advisory. ------------------------------------------------------------------------- Debian LTS Advisory DLA-4084-1 [email protected]...

CVE-2025-27615

CVE-2025-27615 affects umatiGateway. The Red Hat entry describes that the user interface may be publicly accessible when using the provided docker-compose file, allowing configuration to be viewed and altered. The root cause appears to be UI exposure beyond localhost, with a patch in commit 5d81a...

Security Bulletin: DataStage on Cloud Pak for Data is vulnerable to uncontrolled resource consumption due to commons-io.

Summary Commons.io is used by the ds-runtime microservice as part of the read/write functionality. Vulnerability Details CVEID:CVE-2024-47554 DESCRIPTION: Uncontrolled Resource Consumption vulnerability in Apache Commons IO. The org.apache.commons.io.input.XmlStreamReader class may excessively...

Security Bulletin: DataStage on Cloud Pak for Data is vulnerable to denial of service and nonstandard cookie parsing due to hbase-client.

Summary hbase-client is used by the ds-cas-lite microservice as part of the Java client API for HBase. Vulnerability Details CVEID:CVE-2023-26048 DESCRIPTION: Eclipse Jetty is vulnerable to a denial of service, caused by an out of memory flaw in the HttpServletRequest.getParameter or...

Security Bulletin: DataStage on Cloud Pak for Data is vulnerable to denial of service due to hbase-client

Summary hbase-client is used by the ds-cas-lite microservice as part of the HBase API functionality. Vulnerability Details CVEID:CVE-2023-44487 DESCRIPTION: The HTTP/2 protocol allows a denial of service server resource consumption because request cancellation can reset many streams quickly, as...

Security Bulletin: DataStage on Cloud Pak for Data is vulnerable to arbitrary configuration injection due to pip:22.3.1

Summary Pip is used by the DataStage on Cloud Pak for Data px-runtime microservice as part of package installation. Vulnerability Details CVEID:CVE-2023-5752 DESCRIPTION: When installing a package from a Mercurial VCS URL ie "pip install hg+..." with pip prior to v23.3, the specified Mercurial...

Arbitrary Command Injection

Overview plotai is a Create plots in Python with AI Affected versions of this package are vulnerable to Arbitrary Command Injection in executor.py due to lack of validation of LLM-generated output. An attacker can supply code which will then be executed with Python's exec function. Remediation...

Security Bulletin: DataStage on Cloud Pak for Data is vulnerable to denial of service due to hbase-client

Summary hbase-client is used by the ds-cas-lite microservice as part of the HBase API functionality. Vulnerability Details CVEID:CVE-2023-52428 DESCRIPTION: Connect2id Nimbus-JOSE-JWT is vulnerable to a denial of service, caused by improper validation of user requests by the PasswordBasedDecrypte...

CVE-2025-26865

CVE-2025-26865 affects Apache OFBiz 18.12.17 through 18.12.18, due to improper neutralization of special elements in the template engine. It's a regression between 18.12.17 (safe) and 18.12.18 (patched). Affected component is the template engine in OFBiz; Red Hat, CNVD, OSV, NVD, and CVE lists de...

PT-2025-10561 · Pagelayer · Pagelayer

Name of the Vulnerable Software and Affected Versions: Pagelayer versions prior to 1.9.9 Description: The issue is related to Cross-Site Request Forgery due to missing or incorrect nonce validation on the pagelayer save post function. This allows unauthenticated attackers to modify post contents...

Google Chrome < 134.0.6998.89 Vulnerability

The version of Google Chrome installed on the remote Windows host is prior to 134.0.6998.89. It is, therefore, affected by a vulnerability as referenced in the 202503stable-channel-update-for-desktop19 advisory. - CVE-2025-2476 is a use after free in Lens. It was reported by SungKwon Lee of Enki...

PT-2025-11649 · Kemp · Kemp Loadmaster

Name of the Vulnerable Software and Affected Versions: Progress LoadMaster versions 7.2.40.0 and above ECS versions all versions Multi-Tenancy versions 7.1.35.4 and above Description: The issue is related to an improper input validation vulnerability in Progress LoadMaster, which allows a buffer...

PT-2025-10615 · Locals3 · Locals3

Name of the Vulnerable Software and Affected Versions: LocalS3 versions prior to 1.21 Description: The issue concerns XML External Entity XXE injection in the bucket creation endpoint. When processing the CreateBucketConfiguration XML document, the service's XML parser resolves external entities...

Fedora: Security Advisory (FEDORA-2025-2215919645)

The remote host is missing an update for the SPDX-FileCopyrightText: 2025 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

CVE-2025-27636

CVE-2025-27636 affects Apache Camel versions 4.10.0–4.10.1, 4.8.0–4.8.4, and 3.10.0–3.22.3. The root cause is a case-sensitive DefaultHeaderFilterStrategy that only blocks headers starting with Camel, camel, or org.apache.camel., allowing attackers to inject Camel-specific headers. In vulnerable ...

PT-2025-10455 · Joomlaux · Joomlaux Jux Real Estate

Name of the Vulnerable Software and Affected Versions: JoomlaUX JUX Real Estate version 3.4.0 Description: A problematic issue was found in the software, affecting an unknown function of the file /extensions/realestate/index.php/properties/list/list-with-sidebar/realties. The manipulation of the...

PT-2025-14357

Name of the Vulnerable Software and Affected Versions Linux kernel affected versions not specified Description A vulnerability in the Linux kernel has been resolved, related to the removal of a Hyper-V framebuffer device. When the device is unbound, the hyperv fb driver attempts to release the...